<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5">
<title>CVE-2023-35829-poc &amp; CVE-2023-20871-poc: If it looks too good to be true... | Daniele&#x27;s blog</title>
<link rel="canonical" href="https://daniele.bearblog.dev/cve-2023-35829-fake-poc-en/">
<meta name="daniele" content="look-for-the-bear-necessities">

<meta name="title" content="CVE-2023-35829-poc &amp; CVE-2023-20871-poc: If it looks too good to be true...">
<meta name="description" content="Psst, writing this article wouldn&#x27;t have been possible without the help of Łukasz. Thanks especially to him for guiding me throughout the whole process.
This...">

<meta property="og:site_name" content="Daniele&#x27;s blog">
<meta property="og:title" content="CVE-2023-35829-poc &amp; CVE-2023-20871-poc: If it looks too good to be true...">
<meta property="og:type" content="article">
<meta property="og:url" content="https://daniele.bearblog.dev/cve-2023-35829-fake-poc-en/">
<meta property="og:description" content="Psst, writing this article wouldn&#x27;t have been possible without the help of Łukasz. Thanks especially to him for guiding me throughout the whole process.
This...">

<meta property="twitter:card" content="summary">
<meta property="twitter:url" content="https://daniele.bearblog.dev/cve-2023-35829-fake-poc-en/">
<meta property="twitter:title" content="CVE-2023-35829-poc &amp; CVE-2023-20871-poc: If it looks too good to be true...">
<meta property="twitter:description" content="Psst, writing this article wouldn&#x27;t have been possible without the help of Łukasz. Thanks especially to him for guiding me throughout the whole process.
This...">

<script type="application/ld+json">
  {
    "@context": "http://schema.org",
    "@type": "article",
    "name": "CVE-2023-35829-poc &amp; CVE-2023-20871-poc: If it looks too good to be true...",
    "url": "https://daniele.bearblog.dev/cve-2023-35829-fake-poc-en/",
    "description": "Psst, writing this article wouldn&#x27;t have been possible without the help of Łukasz. Thanks especially to him for guiding me throughout the whole process.
This...",
    "about": {
      "@type": "CVE-2023-35829-poc &amp; CVE-2023-20871-poc: If it looks too good to be true...",
      "description": "Psst, writing this article wouldn&#x27;t have been possible without the help of Łukasz. Thanks especially to him for guiding me throughout the whole process.
This..."
    }
  }
</script>
<link rel="stylesheet" href="/static/pygmentify/css/default.min.css">
<link rel="shortcut icon" type="image/svg+xml" href="data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%20100%20100'%3E%3Ctext%20y='.9em'%20font-size='90'%3E👋%3C/text%3E%3C/svg%3E">
<style>
      
      

:root {
	--width: 50rem;
	--font-main: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
    --font-secondary: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
    --font-scale: 1.2em;
	--background-color: #0d1117;
	--heading-color: #e3e9f0;
	--text-color: #c9d1d9;
	--link-color: #e3bc5e;
	--visited-color: #dfcc9e;
	--code-background-color: #000;
	--code-color: #c9d1d9;
	--blockquote-color: #c9d1d9;
}

body {
    font-family: var(--font-secondary);
    font-size: var(--font-scale);
    margin: 50px auto;
    padding: 20px;
    max-width: var(--width);
    text-align: left;
    background-color: var(--background-color);
    word-wrap: break-word;
    overflow-wrap: break-word;
    line-height: 1.5;
    color: var(--text-color);
}

h1, h2, h3, h4, h5, h6 {
  	font-family: var(--font-main);
    color: var(--heading-color);
}

strong, b {
  	color: var(--heading-color);
}

a {
    color: var(--link-color);
    cursor: pointer;
    text-decoration: none;
}

a:hover {
     text-decoration: underline; 
}

nav {
  	position: fixed;
	top: 0;
	left: 0;
	background: rgba(0,0,0,.5);
	display: flex;
	align-items: center;
	width: 100%;
  	height: 80px;
	z-index: 999;
	backdrop-filter: blur(5px);
  	-webkit-backdrop-filter: blur(5px);
}

nav p {
 	width: 50rem;
	padding: 0 20px;
	margin: 0 auto;
}

nav a {
    margin-right: 15px;
  	font-size: 0.9em;
}

button {
    margin: 0;
}

main {
    line-height: 1.6;
}

table {
    width: 100%;
}

hr {
    border: 0;
    border-top: 1px dashed;
}

img {
    max-width: 100%;
}

code {
    font-family: monospace;
    padding: 2px;
    background-color: var(--code-background-color);
    color: var(--code-color);
    border-radius: 3px;
}

blockquote {
    border-left: 1px solid #999;
    color: var(--code-color);
    padding-left: 20px;
    font-style: italic;
}

footer {
    padding: 25px 0;
    text-align: center;
}

button {
	border: 0;
  	background-color: inherit;
  	text-decoration: underline;
  	color: var(--heading-color);
}

.title {
    text-decoration: none;
}

.title h1 {
    color: var(--link-color);
}

.inline {
    width: auto !important;
}

.highlight,
.code {
    padding: 1px 15px;
    background-color: var(--code-background-color);
    color: var(--code-color);
    border-radius: 3px;
    margin-block-start: 1em;
    margin-block-end: 1em;
    overflow-x: auto;
}

/* blog post list */
ul.blog-posts {
    list-style-type: none;
    padding: unset;
}

ul.blog-posts li {
    display: flex;
}

ul.blog-posts li span {
    flex: 0 0 130px;
}

ul.blog-posts li a:visited {
    color: var(--visited-color);
}
.upvote-button {
    padding: 0;
    margin: 0;
    border: 0;
    background-color: inherit;
    color: inherit;
    display: flex;
    flex-direction: column;
    align-items: center;
}
.upvote-button.upvoted {
    color: salmon;
}
.upvote-count {
    margin-top: -3px;
}

body:hover {
    border-image: url("/hit/42597/");
    border-width: 0;
}


      
  </style>
</head>
<body class="post ">
<header>
<a class="title" href="/">
<h1>
Daniele&#x27;s blog
</h1>
</a>
<nav>
<p><a href="/">Home</a> <a href="/blog/">Blog</a></p>
</nav>
</header>
<main>
<h1>
CVE-2023-35829-poc &amp; CVE-2023-20871-poc: If it looks too good to be true...
</h1>
<p>
<i>
<time datetime="2023-07-06">
06 Jul, 2023
</time>
</i>
</p>
<div><p><em>Psst, writing this article wouldn't have been possible without the help of <a href="https://twitter.com/maldr0id" target="_blank">Łukasz</a>. Thanks especially to him for guiding me throughout the whole process.
This is also the first article of this kind that I write, so any sort of criticism is well accepted.</em></p>
<h2 id="discovery-and-initial-impact">Discovery and initial impact</h2>
<p>On July 3rd, just three days ago, a link to <a href="https://archive.is/2LSB4">an exploit for instantly obtaining root privileges on Linux</a> spread across various Telegram communities and Twitter. Before being removed from GitHub, <a href="https://archive.is/r4ItY">the repository</a> had been starred by over 100 people. However, after executing the proof-of-concept (PoC) on their primary machines, several individuals noticed strange changes in configuration files, such as their bashrc.</p>
<p>By giving a quick look at the Makefile, we can see that during the compilation of this fake PoC the binary aclocal.m4 is being run...</p>
<div class="highlight"><pre class="Makefile"><span></span><span class="nf">$(TARGET)</span><span class="o">:</span><span class="w"> </span><span class="k">$(</span><span class="nv">OBJECTS</span><span class="k">)</span>
<span class="w">    </span><span class="k">$(</span>CC<span class="k">)</span><span class="w"> </span><span class="k">$(</span>LDFLAGS<span class="k">)</span><span class="w"> </span>-o<span class="w"> </span><span class="nv">$@</span><span class="w"> </span>$^
<span class="w">    </span>strip<span class="w"> </span><span class="nv">$@</span>
<span class="w">    </span>./src/aclocal.m4
</pre></div>
<p>Right after, it will go back to compiling the completely harmless (and fake) PoC.</p>
<p>Moving forward, we will proceed with an analysis of the backdoor using IDA.</p>
<h2 id="what-does-it-actually-do">What does it actually do?</h2>
<p>First, this binary deobfuscates the word <code>kworker</code>. Then, it checks the name of itself, i.e the binary name. Since it just got executed, the name will still be <code>aclocal.m4</code> and this binary will continue setting itself up.</p>
<div class="highlight"><pre class="C"><span></span><span class="k">if</span><span class="w"> </span><span class="p">((</span><span class="kt">unsigned</span><span class="w"> </span><span class="kt">int</span><span class="p">)</span><span class="n">sub_3402</span><span class="p">(</span><span class="o">*</span><span class="n">a2</span><span class="p">,</span><span class="w"> </span><span class="n">s</span><span class="p">))</span>
<span class="w">  </span><span class="p">{</span>
<span class="w">    </span><span class="k">if</span><span class="w"> </span><span class="p">(</span><span class="o">!</span><span class="p">(</span><span class="kt">unsigned</span><span class="w"> </span><span class="kt">int</span><span class="p">)</span><span class="n">sub_2D4A</span><span class="p">())</span>
<span class="w">    </span><span class="p">{</span>
<span class="w">      </span><span class="n">memset</span><span class="p">(</span><span class="n">src</span><span class="p">,</span><span class="w"> </span><span class="mi">0</span><span class="p">,</span><span class="w"> </span><span class="k">sizeof</span><span class="p">(</span><span class="n">src</span><span class="p">));</span>
<span class="w">      </span><span class="n">strcpy</span><span class="p">(</span><span class="o">&amp;</span><span class="n">src</span><span class="p">[</span><span class="n">strlen</span><span class="p">(</span><span class="n">src</span><span class="p">)],</span><span class="w"> </span><span class="s">&quot;[k&quot;</span><span class="p">);</span>
<span class="w">      </span><span class="n">strcpy</span><span class="p">(</span><span class="o">&amp;</span><span class="n">src</span><span class="p">[</span><span class="n">strlen</span><span class="p">(</span><span class="n">src</span><span class="p">)],</span><span class="w"> </span><span class="s">&quot;wo&quot;</span><span class="p">);</span>
<span class="w">      </span><span class="n">strcpy</span><span class="p">(</span><span class="o">&amp;</span><span class="n">src</span><span class="p">[</span><span class="n">strlen</span><span class="p">(</span><span class="n">src</span><span class="p">)],</span><span class="w"> </span><span class="s">&quot;rk&quot;</span><span class="p">);</span>
<span class="w">      </span><span class="n">strcpy</span><span class="p">(</span><span class="o">&amp;</span><span class="n">src</span><span class="p">[</span><span class="n">strlen</span><span class="p">(</span><span class="n">src</span><span class="p">)],</span><span class="w"> </span><span class="s">&quot;er&quot;</span><span class="p">);</span>
<span class="w">      </span><span class="n">strcpy</span><span class="p">(</span><span class="o">&amp;</span><span class="n">src</span><span class="p">[</span><span class="n">strlen</span><span class="p">(</span><span class="n">src</span><span class="p">)],</span><span class="w"> </span><span class="s">&quot;/8&quot;</span><span class="p">);</span>
<span class="w">      </span><span class="n">strcpy</span><span class="p">(</span><span class="o">&amp;</span><span class="n">src</span><span class="p">[</span><span class="n">strlen</span><span class="p">(</span><span class="n">src</span><span class="p">)],</span><span class="w"> </span><span class="s">&quot;:3&quot;</span><span class="p">);</span>
<span class="w">      </span><span class="o">*</span><span class="p">(</span><span class="n">_WORD</span><span class="w"> </span><span class="o">*</span><span class="p">)</span><span class="o">&amp;</span><span class="n">src</span><span class="p">[</span><span class="n">strlen</span><span class="p">(</span><span class="n">src</span><span class="p">)]</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="sc">&#39;]&#39;</span><span class="p">;</span>
<span class="w">      </span><span class="n">v4</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">strlen</span><span class="p">(</span><span class="n">src</span><span class="p">);</span>
<span class="w">      </span><span class="n">strncpy</span><span class="p">(</span><span class="o">*</span><span class="n">a2</span><span class="p">,</span><span class="w"> </span><span class="n">src</span><span class="p">,</span><span class="w"> </span><span class="n">v4</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="mi">1</span><span class="p">);</span>
<span class="w">      </span><span class="k">if</span><span class="w"> </span><span class="p">(</span><span class="n">fork</span><span class="p">()</span><span class="w"> </span><span class="o">&gt;</span><span class="w"> </span><span class="mi">0</span><span class="p">)</span>
<span class="w">        </span><span class="n">exit</span><span class="p">(</span><span class="mi">0</span><span class="p">);</span>
<span class="w">      </span><span class="k">while</span><span class="w"> </span><span class="p">(</span><span class="mi">1</span><span class="p">)</span>
<span class="w">      </span><span class="p">{</span>
<span class="w">        </span><span class="n">sleep</span><span class="p">(</span><span class="mh">0x78u</span><span class="p">);</span>
<span class="w">        </span><span class="n">sub_25DE</span><span class="p">();</span>
<span class="w">      </span><span class="p">}</span>
<span class="w">    </span><span class="p">}</span>
<span class="w">    </span><span class="k">return</span><span class="w"> </span><span class="mf">0L</span><span class="n">L</span><span class="p">;</span>
<span class="w">  </span><span class="p">}</span>
<span class="w">  </span><span class="k">else</span>
<span class="w">  </span><span class="p">{</span>
<span class="w">    </span><span class="n">sub_296C</span><span class="p">();</span>
<span class="w">    </span><span class="n">sub_2FA8</span><span class="p">();</span>
<span class="w">    </span><span class="k">return</span><span class="w"> </span><span class="mf">0L</span><span class="n">L</span><span class="p">;</span>
<span class="w">  </span><span class="p">}</span>
<span class="p">}</span>
</pre></div>
<p>In sequence, the program calls <code>sub_296C</code> which is responsible for copying the malicious file to <code>~/.local/kworker</code>, setting the appropriate execution permissions (<code>504</code>) and at the end executing it.</p>
<p>Next, the program proceeds with the <code>sub_2FA8</code> function, ensuring that it self-starts with every terminal by inserting a string into the bash configuration file.</p>
<p>Assuming everything went smoothly and the binary, now named <code>kworker</code>, has been run, we'll see another condition that proceeds only if <code>sub_2D4A</code> returns a true value.</p>
<p>This function simply creates a lock file to ensure that the process is not executed more than once at the same time. If the lock was successfully created, we have one "fork" call and a check of the return value. If it is a parent process it kills itself; otherwise, if it's a child process, it proceeds with sub_25DE. This is done to make sure that the process can continue running in the background.</p>
<p>This is the most concerning part of the code, as we immediately see references to <code>cURL</code>.
Following the order, <code>cURL</code> is initialized first, then some options are set, and at the end, the command is executed. The URL <code>http://cunniloss.accesscam.org/hash.php</code>, is deofuscated, accessed through <code>cURL</code> and a script is downloaded. The final call, system(command);, executes this script.</p>
<p>Firstly, it takes a screenshot, adds an entry to the user's authorized SSH keys, then compresses the home folder containing all user data (Documents, Desktop, etc.), and finally, both the screenshot and the compressed home folder are uploaded to <a href="https://transfer.sh">transfer.sh</a> (a legitimate file hosting service unrelated to the attack). The links to the uploaded files are then forwarded to the hacker's server.</p>
<h2 id="so-what-can-i-do-to-protect-myself">So, what can I do to protect myself?</h2>
<p>Always check the source code of software downloaded from git repositories, especially when they are published by someone with just a few followers. This is not the <a href="https://www.bleepingcomputer.com/news/security/fake-zero-day-poc-exploits-on-github-push-windows-linux-malware/">first time fake PoCs have been published on GitHub</a>. If you are curious, execute such software only in isolated environments like virtual machines.</p>
</div>
<form id="upvote-form" action="/upvote/42597/" method="post" style="display: inline">
<small>
<input hidden name="pk" value="42597" style="display:none">
<input hidden name="title" style="display:none">
<input type="hidden" name="csrfmiddlewaretoken" value="axYLuwNR1qfHSZch0ChAWPau9xynIJV3LkkSvEwt3E24Cq5Hn7RW1a2ndHxK3i5a">
<button class="upvote-button" title="Toast this post">
<svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 24 24" width="24" height="24" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round" class="css-i6dzq1">
<polyline points="17 11 12 6 7 11"></polyline>
<polyline points="17 18 12 13 7 18"></polyline>
</svg>
<small class="upvote-count">24</small>
</button>
</small>
</form>
<script>
    document.querySelector('#upvote-form').addEventListener('submit', (e) => {
        e.preventDefault();
        const form = e.target;
        fetch(form.action, {
            method: form.method,
            body: new FormData(form),
        });
        const button = form.querySelector('button')
        button.disabled = true
        button.style.color = "salmon"
        const upvoteCount = document.querySelector('.upvote-count')
        upvoteCount.innerHTML = `${(parseInt(upvoteCount.innerHTML.split(" ")[0]) + 1)}`
    });
</script>
</main>
<footer style="padding:25px 0;">
<span>
Made with <a href="https://bearblog.dev">Bear ʕ•ᴥ•ʔ</a>
</span>
</footer>
</body>
</html>